detecting-t1003-credential-dumping-with-edr
mukul975/Anthropic-Cybersecurity-Skills
Uses EDR telemetry, Sysmon and Defender logs to detect T1003 credential dumping targeting LSASS memory, SAM, NTDS, cached credentials, and DCSync activity, helping hunters map suspicious access, lateral movement, and impacted accounts.
